agent-dealer 0.2.0 → 1.0.0

package/bundle/server/dist/repository/review-publications.js

@@ -0,0 +1,153 @@
+// packages/server/src/repository/review-publications.ts
+//
+// A one-row-per-work-item durable claim + result (NOT-62 review rounds 2-4), inserted
+// atomically BEFORE the reviewer effect calls `gh pr review`. A `gh` review submission
+// isn't naturally idempotent the way a `git push` is, and a read-only "does a review
+// already exist" lookup alone is a check-then-publish race — two overlapping attempts on
+// the same work item could both observe "not found" before either has published.
+//
+// The claim is gated on the SAME lease token the work-item kernel already uses (round 4):
+// every write here requires the caller's `leaseToken` to still equal the live
+// `work_items.lease_token`, with `status = 'leased'` AND `lease_expires_at` still in the
+// future (round 5 — `status` alone lags reality: a work item sits at `status = 'leased'`
+// with its old token for the whole window between the lease actually expiring and
+// recovery's next sweep reclaiming it, and an attempt resuming inside that window is not
+// "live" just because no one has swept it yet), checked in the same statement as the
+// write. A zombie whose lease has already expired or been reclaimed can therefore never
+// win — or reclaim — this claim, no matter how the two attempts' wall-clock timing
+// happens to fall; only whichever attempt currently holds the work item's one *unexpired*
+// lease token ever can. Without this, an earlier design let a slower-but-still-"leased"
+// zombie win the claim ahead of the actual current lease holder, which would then time
+// out waiting and apply `publish_failed` as the workflow's terminal decision while the
+// zombie went on to actually publish moments later — the exact "GitHub and workflow
+// state disagree" failure mode this table exists to prevent. Once the winner records its
+// actual result, a loser reports exactly that (never its own independently-produced
+// verdict, which two separate reviewer sessions really can disagree on).
+//
+// Round 6: checking the lease is only "live" at the instant of claiming isn't enough —
+// nothing stopped the underlying lease from expiring, and recovery reclaiming it to a
+// new attempt, WHILE the `gh pr review` call granted by this claim is still in flight.
+// So granting a claim now ALSO atomically extends the work item's lease
+// (`PUBLICATION_LEASE_EXTENSION_MS`) in the same transaction as the claim itself —
+// recovery's own reclaim query (`work_items.lease_expires_at < now`) is a single
+// statement too, so the two can never interleave: either recovery's reclaim commits
+// first (and this claim's own live-lease check then correctly fails) or this claim's
+// extension commits first (and recovery's reclaim then correctly does not match). The
+// ambient per-tick heartbeat (`worker-loop.ts`) would ordinarily keep re-extending the
+// lease throughout anyway on a healthy process, but that protection is incidental to
+// this table; the extension here makes holding the claim its own explicit, structural
+// guarantee for the whole publish operation, not something borrowed from unrelated
+// machinery timing.
+import { getDb } from "../db/index.js";
+const num = (name, dflt) => Number(process.env[name] ?? dflt);
+/**
+ * How long a granted claim guarantees the underlying lease stays valid for — must
+ * comfortably exceed how long a real `gh pr review` call can take. Deliberately much
+ * longer than the work-item kernel's own default per-heartbeat `leaseMs` (60s): this is
+ * a one-shot grant at claim time, not refreshed on a timer the way the heartbeat is.
+ */
+function publicationLeaseExtensionMs() {
+    return num("REVIEWER_PUBLISH_LEASE_EXTENSION_MS", 5 * 60_000);
+}
+function rowFrom(raw) {
+    return {
+        workItemId: raw.work_item_id,
+        state: raw.state,
+        resultJson: raw.result_json,
+        event: raw.event,
+        usedCommentFallback: raw.used_comment_fallback === 1,
+    };
+}
+/**
+ * True only while `leaseToken` is still the work item's current, ACTUALLY-active lease
+ * — `status = 'leased'` on its own is not enough (it lags an expiry that recovery hasn't
+ * swept yet); `lease_expires_at` must still be in the future too.
+ */
+const STILL_LEASED = `EXISTS (
+  SELECT 1 FROM work_items
+  WHERE id = @work_item_id AND lease_token = @lease_token AND status = 'leased' AND lease_expires_at > @now
+)`;
+/**
+ * Extends `workItemId`'s lease so it cannot expire (and so be reclaimed by recovery)
+ * before `publicationLeaseExtensionMs()` has elapsed. Re-checks the live-lease condition
+ * itself — a caller only extends a lease it is actually the current, live holder of.
+ * Must be called from inside the same transaction as the claim/reclaim grant it protects.
+ */
+function extendLeaseForPublication(workItemId, leaseToken, now) {
+    const expires = new Date(Date.parse(now) + publicationLeaseExtensionMs()).toISOString();
+    getDb()
+        .prepare("UPDATE work_items SET lease_expires_at = @expires, updated_at = @now WHERE id = @work_item_id AND lease_token = @lease_token AND status = 'leased'")
+        .run({ work_item_id: workItemId, lease_token: leaseToken, expires, now });
+}
+/**
+ * Returns true if this call won the claim and may proceed to publish. False either
+ * because another attempt already holds/held it, or because `leaseToken` is no longer
+ * the work item's current lease (this attempt is itself the zombie — it must not
+ * publish regardless of who else is racing it). Winning atomically extends the
+ * underlying work-item lease (see module doc) so recovery cannot reclaim it out from
+ * under the `gh` call this grant is about to allow.
+ */
+export function claimReviewPublication(workItemId, leaseToken) {
+    const now = new Date().toISOString();
+    return getDb().transaction(() => {
+        const result = getDb()
+            .prepare(`
+        INSERT INTO review_publications (work_item_id, state, claimed_at, updated_at)
+        SELECT @work_item_id, 'claimed', @now, @now
+        WHERE NOT EXISTS (SELECT 1 FROM review_publications WHERE work_item_id = @work_item_id)
+          AND ${STILL_LEASED}
+      `)
+            .run({ work_item_id: workItemId, lease_token: leaseToken, now });
+        if (result.changes !== 1)
+            return false;
+        extendLeaseForPublication(workItemId, leaseToken, now);
+        return true;
+    })();
+}
+export function getReviewPublication(workItemId) {
+    const row = getDb().prepare("SELECT * FROM review_publications WHERE work_item_id = ?").get(workItemId);
+    return row ? rowFrom(row) : null;
+}
+/** Only the current claimant (state = 'claimed') may record a result — a stale writer can never overwrite one. */
+export function recordReviewPublished(workItemId, input) {
+    getDb()
+        .prepare("UPDATE review_publications SET state = 'published', result_json = ?, event = ?, used_comment_fallback = ?, updated_at = ? WHERE work_item_id = ? AND state = 'claimed'")
+        .run(input.resultJson, input.event, input.usedCommentFallback ? 1 : 0, new Date().toISOString(), workItemId);
+}
+export function recordReviewPublishFailed(workItemId) {
+    getDb()
+        .prepare("UPDATE review_publications SET state = 'failed', updated_at = ? WHERE work_item_id = ? AND state = 'claimed'")
+        .run(new Date().toISOString(), workItemId);
+}
+/**
+ * Lets a new attempt retry publishing after a prior claimant recorded `failed` (it ran,
+ * but its own `gh` call never succeeded) — gated on the same live lease check as
+ * `claimReviewPublication`, so only the work item's current holder can ever reclaim.
+ *
+ * A stale `claimed` row (the claimant crashed between `gh` succeeding and this table
+ * being updated) is deliberately NOT reclaimable at all, by anyone, ever — surfacing
+ * instead as a human-visible `publish_failed` escalation. This is a known, accepted gap
+ * (a review already posted to GitHub could in that narrow case go unrecorded here): it
+ * fails toward a human double-checking an already-safe state rather than toward an
+ * automatic decision this code cannot actually verify is safe, matching this codebase's
+ * general policy of escalating, not guessing, when a prior attempt's true fate is
+ * unknown (see `profile-snapshot.ts`'s `PermissionPolicy` doc comment for the same
+ * reasoning applied elsewhere).
+ */
+export function reclaimFailedReviewPublication(workItemId, leaseToken) {
+    const now = new Date().toISOString();
+    return getDb().transaction(() => {
+        const result = getDb()
+            .prepare(`
+        UPDATE review_publications
+        SET state = 'claimed', claimed_at = @now, updated_at = @now
+        WHERE work_item_id = @work_item_id AND state = 'failed'
+          AND ${STILL_LEASED}
+      `)
+            .run({ work_item_id: workItemId, lease_token: leaseToken, now });
+        if (result.changes !== 1)
+            return false;
+        extendLeaseForPublication(workItemId, leaseToken, now);
+        return true;
+    })();
+}

package/bundle/server/dist/repository/review-publications.test.js

@@ -0,0 +1,78 @@
+// packages/server/src/repository/review-publications.test.ts
+//
+// NOT-62 review round 6: a claim grant must not just check the lease is live at that
+// instant — it must also extend it, atomically, so recovery's own reclaim query cannot
+// later match this work item while the `gh` call the claim protects is still in flight.
+// These tests exercise that directly against `listExpiredLeases`, the exact function
+// `coordinator/recovery.ts` uses to find reclaimable leases — not just a raw timestamp
+// field — so a regression that broke the actual guarantee (not merely the column value)
+// would be caught here.
+import { test, before, beforeEach } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-reviewpub-"));
+process.env.REVIEWER_PUBLISH_LEASE_EXTENSION_MS = "300000";
+const { migrate, getDb } = await import("../db/index.js");
+const { createAgent } = await import("../repository/agents.js");
+const { createIssue } = await import("./issues.js");
+const { startWorkflowInstance } = await import("./workflow-events.js");
+const { enqueueWorkItem, claimWorkItem, listExpiredLeases } = await import("./work-items.js");
+const { claimReviewPublication, recordReviewPublishFailed, reclaimFailedReviewPublication } = await import("./review-publications.js");
+before(() => migrate());
+beforeEach(() => getDb().exec("DELETE FROM review_publications; DELETE FROM work_items;"));
+function freshLeasedWorkItem() {
+    const dev = createAgent({ name: `dev-${Math.random()}`, runtime: "claude_code", deckId: "00000000-0000-4000-a000-000000000099" });
+    const rev = createAgent({ name: `rev-${Math.random()}`, runtime: "claude_code", deckId: "00000000-0000-4000-a000-000000000099" });
+    const issue = createIssue({
+        title: "T",
+        repo: "acme/app",
+        developerAgentId: dev.id,
+        reviewerAgentId: rev.id,
+        baseBranch: "main",
+        maxReviewRounds: 3,
+        maxInfraAttempts: 3,
+        source: "manual"
+    });
+    const instance = startWorkflowInstance(issue.id, "dev_reviewer_v1");
+    enqueueWorkItem({ issueId: issue.id, workflowInstanceId: instance.id, kind: "reviewer", round: 1 });
+    // A very short leaseMs — about to expire on its own, matching the round-6 scenario.
+    const claimed = claimWorkItem("test-owner", { leaseMs: 20 });
+    return { id: claimed.id, leaseToken: claimed.leaseToken };
+}
+test("claiming publication extends the lease so recovery's own reclaim query no longer matches, even though the original lease was about to expire", async () => {
+    // leaseMs: 20 in freshLeasedWorkItem — the ORIGINAL lease is about to expire on its
+    // own; claiming happens immediately, while it's still (barely) live.
+    const { id, leaseToken } = freshLeasedWorkItem();
+    assert.equal(claimReviewPublication(id, leaseToken), true);
+    // Wait past when the ORIGINAL 20ms lease would have expired.
+    await new Promise((resolve) => setTimeout(resolve, 40));
+    // Recovery's exact reclaim query must not see this item as expired, now or for the
+    // whole extension window — not just at the instant it was claimed.
+    assert.equal(listExpiredLeases(Date.now()).some((i) => i.id === id), false);
+    assert.equal(listExpiredLeases(Date.now() + 60_000).some((i) => i.id === id), false, "must stay unreclaimable well past the original lease's own duration");
+});
+test("reclaiming a failed publication also extends the lease", async () => {
+    const { id, leaseToken } = freshLeasedWorkItem();
+    assert.equal(claimReviewPublication(id, leaseToken), true);
+    recordReviewPublishFailed(id);
+    // The first claim's own extension is still ~5 minutes out — reset it back down to
+    // something about to expire again, so reclaiming below (called while it's still
+    // barely valid) is what has to be the thing keeping it alive past that point, not
+    // leftover slack from the first claim's extension.
+    getDb().prepare("UPDATE work_items SET lease_expires_at = ? WHERE id = ?").run(new Date(Date.now() + 20).toISOString(), id);
+    assert.equal(reclaimFailedReviewPublication(id, leaseToken), true);
+    await new Promise((resolve) => setTimeout(resolve, 40)); // past that reset 20ms window
+    assert.equal(listExpiredLeases(Date.now()).some((i) => i.id === id), false, "reclaiming must extend the lease too, not just a fresh claim");
+});
+test("a claim attempt whose lease is already gone (recovery reclaimed first) never extends anything", async () => {
+    const { id, leaseToken } = freshLeasedWorkItem();
+    // Recovery reclaims first: a fresh claimWorkItem-style rotation onto a new token would
+    // normally do this; simplest faithful simulation is directly rotating the token/lease.
+    getDb().prepare("UPDATE work_items SET lease_token = ? WHERE id = ?").run("someone-elses-token", id);
+    assert.equal(claimReviewPublication(id, leaseToken), false, "a stale token must never win the claim");
+    // And it must not have extended the (now someone-else's) lease either.
+    const row = getDb().prepare("SELECT lease_expires_at FROM work_items WHERE id = ?").get(id);
+    assert.ok(new Date(row.lease_expires_at).getTime() < Date.now() + 60_000, "a losing claim attempt must not extend the lease it doesn't hold");
+});

package/bundle/server/dist/repository/runs-external-id.test.js

@@ -7,11 +7,9 @@ process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-ex
 process.env.MAX_CONCURRENT_RUNS = "0";
 const { migrate } = await import("../db/index.js");
 const { BUILTIN_AGENT_CLAUDE_ID } = await import("@agent-dealer/shared");
-const { updateAgent } = await import("./agents.js");
 const { createRun } = await import("./runs.js");
 before(() => {
     migrate();
-    updateAgent(BUILTIN_AGENT_CLAUDE_ID, { workspaceRoot: process.env.AGENT_DEALER_HOME });
 });
 test("manual create mints external_id = run.id and leaves external_label null", () => {
     const run = createRun({
@@ -19,6 +17,7 @@ test("manual create mints external_id = run.id and leaves external_label null",
         taskCategory: "other",
         status: "plan_pending",
         agentId: BUILTIN_AGENT_CLAUDE_ID,
+        repo: "acme/app"
     });
     assert.equal(run.externalId, run.id);
     assert.equal(run.externalLabel, null);
@@ -30,17 +29,19 @@ test("manual retry copies parent external_id", () => {
         taskCategory: "other",
         status: "plan_pending",
         agentId: BUILTIN_AGENT_CLAUDE_ID,
+        repo: "acme/app"
     });
     const child = createRun({
         title: parent.title,
         taskCategory: parent.taskCategory,
         status: "plan_approved",
         agentId: BUILTIN_AGENT_CLAUDE_ID,
+        repo: "acme/app"
     }, {
         source: parent.source,
         externalId: parent.externalId ?? undefined,
         externalLabel: parent.externalLabel ?? undefined,
-        lineageId: parent.lineageId ?? parent.id,
+        lineageId: parent.lineageId ?? parent.id
     });
     assert.equal(child.externalId, parent.externalId);
     assert.equal(child.externalId, parent.id);
@@ -54,6 +55,7 @@ test("explicit linear externalId is not replaced by run.id", () => {
         taskCategory: "code",
         status: "plan_pending",
         agentId: BUILTIN_AGENT_CLAUDE_ID,
+        repo: "acme/app"
     }, { source: "linear", externalId: issueId, externalLabel: "LIN-1" });
     assert.equal(run.externalId, issueId);
     assert.equal(run.externalLabel, "LIN-1");

package/bundle/server/dist/repository/runs.js

@@ -1,5 +1,5 @@
 import { CURSOR_DEFAULT_MODEL } from "@agent-dealer/shared";
-import { mergeRunBudget, parsePhaseBudget, parseRunBudget, resolvePhaseBudget, serializeRunBudget, } from "@agent-dealer/shared";
+import { parsePhaseBudget, parseRunBudget, resolvePhaseBudget, serializeRunBudget, } from "@agent-dealer/shared";
 import { canTransition } from "@agent-dealer/shared";
 import { v4 as uuid } from "uuid";
 import { getDb } from "../db/index.js";
@@ -43,9 +43,9 @@ export function createRun(input, opts) {
         agentProfile?.defaultPlanModel ??
         (isCursor ? CURSOR_DEFAULT_MODEL : null);
     const executeModel = input.executeModel ?? input.planModel ?? agentProfile?.defaultExecuteModel ?? planModel;
-    const repo = input.repo ?? agent.workspaceRoot ?? null;
+    const repo = input.repo ?? null;
     if (!repo) {
-        throw new Error("Agent workspace not configured — set workspace on Agents page or provide repo override");
+        throw new Error("Repo is required — provide a repository path/URL on the task (agent workspace is no longer used)");
     }
     const source = opts?.source ?? "manual";
     const externalId = opts?.externalId ?? (source === "manual" ? id : null);
@@ -63,7 +63,7 @@ export function createRun(input, opts) {
         agent_name: agent.agentName,
         deck_id: agent.deckId ?? null,
         deck_name: agent.deckName ?? opts?.deckName ?? null,
-        playbook_id: agent.playbookId ?? null,
+        playbook_id: null,
         runtime: agent.runtime,
         plan_model: planModel,
         execute_model: executeModel,
@@ -103,47 +103,6 @@ export function getRun(id) {
     const row = getDb().prepare("SELECT * FROM runs WHERE id = ?").get(id);
     return row ? rowToRun(row) : null;
 }
-export function listRuns(status) {
-    const db = getDb();
-    if (!status) {
-        const rows = db.prepare("SELECT * FROM runs ORDER BY updated_at DESC").all();
-        return rows.map(rowToRun);
-    }
-    const statuses = Array.isArray(status) ? status : [status];
-    const placeholders = statuses.map(() => "?").join(",");
-    const rows = db
-        .prepare(`SELECT * FROM runs WHERE status IN (${placeholders}) ORDER BY updated_at DESC`)
-        .all(...statuses);
-    return rows.map(rowToRun);
-}
-export function countByStatus(status) {
-    const row = getDb()
-        .prepare("SELECT COUNT(*) as c FROM runs WHERE status = ?")
-        .get(status);
-    return row.c;
-}
-export function findByExternalId(source, externalId) {
-    const row = getDb()
-        .prepare("SELECT * FROM runs WHERE source = ? AND external_id = ?")
-        .get(source, externalId);
-    return row ? rowToRun(row) : null;
-}
-export function findActiveByExternalId(source, externalId) {
-    const row = getDb()
-        .prepare(`SELECT * FROM runs WHERE source = ? AND external_id = ? AND status NOT IN ('done', 'cancelled')`)
-        .get(source, externalId);
-    return row ? rowToRun(row) : null;
-}
-/** plan_pending runs where the agent (or human) has written a plan — ready for review. */
-export function listRunsReadyForPlanReview() {
-    const rows = getDb()
-        .prepare(`SELECT DISTINCT r.* FROM runs r
-       INNER JOIN artifacts a ON a.run_id = r.id AND a.kind = 'draft_plan'
-       WHERE r.status = 'plan_pending'
-       ORDER BY r.updated_at ASC`)
-        .all();
-    return rows.map(rowToRun);
-}
 export function resolveBudgetForPhase(run, phase) {
     const agent = run.agentId ? getAgent(run.agentId) : null;
     return resolvePhaseBudget({
@@ -154,38 +113,6 @@ export function resolveBudgetForPhase(run, phase) {
         testMode: process.env.AGENT_DEALER_TEST_BUDGET === "1",
     });
 }
-export function updateRunBudget(id, patch) {
-    const run = getRun(id);
-    if (!run)
-        throw new Error(`Run not found: ${id}`);
-    const merged = mergeRunBudget(parseRunBudget(run.budgetJson), patch);
-    const budgetJson = serializeRunBudget(merged);
-    const now = new Date().toISOString();
-    getDb().prepare("UPDATE runs SET budget_json = ?, updated_at = ? WHERE id = ?").run(budgetJson, now, id);
-    const updated = getRun(id);
-    if (!updated)
-        throw new Error(`Run vanished: ${id}`);
-    return updated;
-}
-export function patchRunPhaseBudget(id, phase, budget) {
-    if (budget === undefined)
-        return getRun(id);
-    // null = clear run-level override for this phase (revert to agent defaults)
-    return updateRunBudget(id, { [phase]: budget });
-}
-export function resolveModelForPhase(run, phase) {
-    const agent = run.agentId ? getAgent(run.agentId) : null;
-    const isCursor = run.runtime === "cursor_local";
-    const raw = phase === "plan"
-        ? (run.planModel ?? agent?.defaultPlanModel ?? null)
-        : (run.executeModel ?? agent?.defaultExecuteModel ?? run.planModel ?? agent?.defaultPlanModel ?? null);
-    const trimmed = raw?.trim();
-    if (trimmed)
-        return trimmed;
-    if (isCursor)
-        return CURSOR_DEFAULT_MODEL;
-    return undefined;
-}
 function applyRunFieldPatch(current, patch) {
     return {
         ...current,
@@ -316,64 +243,6 @@ export function appendEvent(runId, type, payload) {
         .run(id, runId, type, payloadJson, ts);
     return { id, runId, type, payloadJson, ts };
 }
-export function listEvents(runId) {
-    const rows = getDb()
-        .prepare("SELECT * FROM events WHERE run_id = ? ORDER BY ts ASC")
-        .all(runId);
-    return rows.map((r) => ({
-        id: r.id,
-        runId: r.run_id,
-        type: r.type,
-        payloadJson: r.payload_json,
-        ts: r.ts,
-    }));
-}
-export function updateArtifactContent(artifactId, content) {
-    const contentJson = JSON.stringify(content);
-    getDb()
-        .prepare("UPDATE artifacts SET content_json = ? WHERE id = ?")
-        .run(contentJson, artifactId);
-    const row = getDb()
-        .prepare("SELECT * FROM artifacts WHERE id = ?")
-        .get(artifactId);
-    return {
-        id: row.id,
-        runId: row.run_id,
-        kind: row.kind,
-        contentJson: row.content_json,
-        blobPath: row.blob_path,
-        author: row.author,
-        createdAt: row.created_at,
-    };
-}
-/** Most recent run in the same lineage before `run` (retry parent). */
-export function getLineageParentRun(run) {
-    const lineageId = run.lineageId;
-    if (!lineageId)
-        return null;
-    const row = getDb()
-        .prepare(`
-      SELECT * FROM runs
-      WHERE (lineage_id = @lineage_id OR id = @lineage_id)
-        AND id != @run_id
-      ORDER BY created_at DESC
-      LIMIT 1
-    `)
-        .get({ lineage_id: lineageId, run_id: run.id });
-    return row ? rowToRun(row) : null;
-}
-/** All runs in a lineage (root first), including cancelled retries. */
-export function listLineageRuns(run) {
-    const lineageId = run.lineageId ?? run.id;
-    const rows = getDb()
-        .prepare(`
-      SELECT * FROM runs
-      WHERE lineage_id = @lineage_id OR id = @lineage_id
-      ORDER BY created_at ASC
-    `)
-        .all({ lineage_id: lineageId });
-    return rows.map(rowToRun);
-}
 export function getLatestArtifact(runId, kind) {
     const row = getDb()
         .prepare("SELECT * FROM artifacts WHERE run_id = ? AND kind = ? ORDER BY created_at DESC LIMIT 1")
@@ -390,79 +259,3 @@ export function getLatestArtifact(runId, kind) {
         createdAt: row.created_at,
     };
 }
-/** Latest plan_triage stops auto-approving / accepting answers once a human takes over the plan. */
-export function markPlanTriageConsumed(runId) {
-    const art = getLatestArtifact(runId, "plan_triage");
-    if (!art?.contentJson)
-        return;
-    try {
-        const content = JSON.parse(art.contentJson);
-        if (content.consumed === true)
-            return;
-        updateArtifactContent(art.id, { ...content, consumed: true });
-    }
-    catch {
-        /* leave malformed triage untouched */
-    }
-}
-const OPS_BOARD_STATUSES = [
-    "queued",
-    "plan_pending",
-    "plan_approved",
-    "running",
-    "review",
-    "failed",
-];
-function inferOpsStatusFromArtifacts(runId) {
-    const exec = getLatestArtifact(runId, "execution_result");
-    if (exec?.contentJson) {
-        try {
-            const content = JSON.parse(exec.contentJson);
-            if (content.isError || (content.exitCode !== undefined && content.exitCode !== 0)) {
-                return "failed";
-            }
-            return "review";
-        }
-        catch {
-            return "review";
-        }
-    }
-    if (getLatestArtifact(runId, "approved_plan"))
-        return "plan_approved";
-    return "plan_pending";
-}
-export function statusBeforeCancel(runId) {
-    const events = listEvents(runId);
-    for (let i = events.length - 1; i >= 0; i--) {
-        const e = events[i];
-        if (e.type !== "run.status_changed" || !e.payloadJson)
-            continue;
-        try {
-            const payload = JSON.parse(e.payloadJson);
-            if (payload.to === "cancelled" && payload.from && OPS_BOARD_STATUSES.includes(payload.from)) {
-                return payload.from;
-            }
-        }
-        catch {
-            // skip malformed event
-        }
-    }
-    return inferOpsStatusFromArtifacts(runId);
-}
-/** Return a given-up run to the Operations board at its prior stage. */
-export function restoreRun(id) {
-    const run = getRun(id);
-    if (!run)
-        throw new Error(`Run not found: ${id}`);
-    if (run.status !== "cancelled") {
-        throw new Error(`Run is not given up (status: ${run.status})`);
-    }
-    const to = statusBeforeCancel(id);
-    const now = new Date().toISOString();
-    getDb().prepare("UPDATE runs SET status = ?, updated_at = ? WHERE id = ?").run(to, now, id);
-    appendEvent(id, "run.restored", { to });
-    const updated = getRun(id);
-    if (!updated)
-        throw new Error(`Run vanished: ${id}`);
-    return updated;
-}

package/bundle/server/dist/repository/runtime-availability.js

@@ -0,0 +1,54 @@
+// packages/server/src/repository/runtime-availability.ts
+//
+// NOT-111: durable per-runtime (account-level) usage-cap state. Runners write when they
+// observe a hard cap; coordinator and queue admission read via runtimeAvailability().
+import { getDb } from "../db/index.js";
+/** Upsert the latest cap observation for a runtime (one row per runtime). */
+export function recordRuntimeAvailability(input) {
+    const now = new Date().toISOString();
+    getDb()
+        .prepare(`
+      INSERT INTO runtime_availability (runtime, unavailable_until, reason, evidence_json, observed_at)
+      VALUES (@runtime, @unavailable_until, @reason, @evidence_json, @observed_at)
+      ON CONFLICT(runtime) DO UPDATE SET
+        unavailable_until = excluded.unavailable_until,
+        reason = excluded.reason,
+        evidence_json = excluded.evidence_json,
+        observed_at = excluded.observed_at
+    `)
+        .run({
+        runtime: input.runtime,
+        unavailable_until: input.unavailableUntil,
+        reason: input.reason,
+        evidence_json: input.evidence !== undefined ? JSON.stringify(input.evidence) : null,
+        observed_at: now,
+    });
+}
+/** Clear a runtime row once its unavailable_until has passed (lazy cleanup on read). */
+function clearExpired(runtime, nowMs = Date.now()) {
+    getDb()
+        .prepare("DELETE FROM runtime_availability WHERE runtime = ? AND unavailable_until <= ?")
+        .run(runtime, new Date(nowMs).toISOString());
+}
+/**
+ * Single read function for coordinator deferral and NOT-103 queue admission.
+ * Returns `{ available: true }` when no active cap is recorded.
+ */
+export function runtimeAvailability(runtime, nowMs = Date.now()) {
+    clearExpired(runtime, nowMs);
+    const row = getDb()
+        .prepare("SELECT * FROM runtime_availability WHERE runtime = ?")
+        .get(runtime);
+    if (!row)
+        return { available: true };
+    const untilMs = Date.parse(row.unavailable_until);
+    if (!Number.isFinite(untilMs) || untilMs <= nowMs) {
+        getDb().prepare("DELETE FROM runtime_availability WHERE runtime = ?").run(runtime);
+        return { available: true };
+    }
+    return { available: false, until: row.unavailable_until, reason: row.reason };
+}
+/** Test helper — wipe all cap rows. */
+export function clearAllRuntimeAvailability() {
+    getDb().exec("DELETE FROM runtime_availability");
+}

package/bundle/server/dist/repository/usage-events.js

@@ -0,0 +1,60 @@
+import { v4 as uuid } from "uuid";
+import { getDb } from "../db/index.js";
+function rowToUsageEvent(row) {
+    return {
+        id: row.id,
+        issueId: row.issue_id,
+        workerSessionId: row.worker_session_id,
+        role: row.role,
+        runtime: row.runtime,
+        tokensIn: row.tokens_in,
+        tokensOut: row.tokens_out,
+        costUsd: row.cost_usd,
+        durationMs: row.duration_ms,
+        ts: row.ts,
+    };
+}
+export function recordUsageEvent(input) {
+    const row = {
+        id: uuid(),
+        issue_id: input.issueId,
+        worker_session_id: input.workerSessionId,
+        role: input.role,
+        runtime: input.runtime ?? null,
+        tokens_in: input.tokensIn ?? null,
+        tokens_out: input.tokensOut ?? null,
+        cost_usd: input.costUsd ?? null,
+        duration_ms: input.durationMs ?? null,
+        ts: new Date().toISOString(),
+    };
+    getDb().prepare(`
+    INSERT INTO usage_events (
+      id, issue_id, worker_session_id, role, runtime, tokens_in, tokens_out, cost_usd, duration_ms, ts
+    ) VALUES (
+      @id, @issue_id, @worker_session_id, @role, @runtime, @tokens_in, @tokens_out, @cost_usd, @duration_ms, @ts
+    )
+  `).run(row);
+    return rowToUsageEvent(row);
+}
+export function summarizeIssueUsage(issueId) {
+    const row = getDb()
+        .prepare(`SELECT
+        COALESCE(SUM(cost_usd), 0) as total_cost,
+        COALESCE(SUM(duration_ms), 0) as total_duration,
+        COALESCE(SUM(tokens_in), 0) as total_in,
+        COALESCE(SUM(tokens_out), 0) as total_out
+       FROM usage_events WHERE issue_id = ?`)
+        .get(issueId);
+    return {
+        totalCostUsd: row.total_cost,
+        totalDurationMs: row.total_duration,
+        totalTokensIn: row.total_in,
+        totalTokensOut: row.total_out,
+    };
+}
+export function listUsageEventsForIssue(issueId) {
+    const rows = getDb()
+        .prepare("SELECT * FROM usage_events WHERE issue_id = ? ORDER BY ts ASC")
+        .all(issueId);
+    return rows.map(rowToUsageEvent);
+}